Contents

Claws Mail & S/MIME plugin howto

Recently there were many requests on the mailing list on how to configure the S/MIME plugin to work properly. It is not a trivial task as the GUI doesn't provide any configuration options and everything needs to be done in the console.

I've had a "half-working" setup but always failed on some point when importing S/MIME certificates. I now managed to have a working config and hopefully this howto will give an insight on how to achieve it.

This howto is based on Gentoo but should be working fine on every other distribution if adjusting it accordingly :)

Importing S/MIME certificates into gpgsm

First one has to obtain the Thawte Freemail certificate and install it into Firefox/Thunderbird. Export the certificate from Firefox/Thunderbird e.g. to "certbundle.p12" file and remember the passphrase.

If this doesn't show a secret key, you may have to import the three certificates from certbundle.pem: separate them to three files (starting with "--- BEGIN CERTIFICATE ---" and ending with "--- END CERTIFICATE ---"), then run

$ gpgsm --import cert1.pem cert2.pem cert3.pem

Configuring S/MIME

You need to create the file (if it doesn't exist) "$HOME/.gnupg/trustlist.txt" to add Thawte to the trusted key list. This makes it possible to verify/sign/.../ with your Thawte certificate. I also added my own certificate to the trustlist. Add the following lines which contain the fingerprint (not serial number!) of the key and the letter S at the end:

gpg-agent is only necessary for caching the passphrase: "$HOME/.gnupg/gpg-agent.conf"

pinentry-program /usr/bin/pinentry-qt
default-cache-ttl 86400 # be aware that the passphrases will be cached for 86400 seconds! set accordingly to your need
max-cache-ttl 86400
disable-scdaemon
allow-mark-trusted

Working with S/MIME plugin and problems/bugs

As of current CVS (CM =>2.7.0cvs11 and S/MIME >=0.5.8cvs2) the S/MIME plugin is more RFC compliant and signing, encrypting, decrypting and verifying messages is working very well now. I tested compatibility with Outlook 11 and Thunderbird, some Kmail emails in my inbox decrypt fine too!

I'm only aware of one problem, where you'll get "Bad signature" warnings, when you forward (via CM) a signed+encrypted email with an attachment and sign+encrypt the email itself again too.

It seems the "Trust key" dialog doesn't show the name of the key, e.g. "The key of ' ' is not fully trusted". CM first asks for the key of the recipient and then asks for the sender's key because CM can't extract it properly: "No exact match for 'email@address'; please select the key." (guess that is because I have two certs..). If I send an email to a friend and include myself (To:), CM will ask me three times for the correct keys.

As of now the "Select Keys" dialog when encrypting emails is a bit awkward to use if you have more than one key (e.g. one additional key that is expired and you still want to keep it to be able to decrypt older emails). It only shows the Key ID and no info about the expiry date which makes it more difficult to choose the correct one.